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( TS//SI//NF) Introduction 

U.5. as World’s Telecommunications Backbone 



Much of the world’s 
communications flow 
through the U.S. 

A target’s phone call, e-mail 
or chat will take the 
cheapest path, not the 
physically most direct 
path - you can’t always 
predict the path. 



• Your target’s 
communications could 
easily be flowing into and 
through the U.S. 





International Internet Regional Bandwidth Capacity in 201 1 

Source: Telegeography Research 
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(TS//SI//NF) FAA702 Operations 

Two Types of Collection 



Upstream 



paltalk^m 

ConrrvKatcr. Beync 




AOL mail A 





You 
Should 
Use Both 



Collection directly from the servers of these U.S. 
Service Providers: Microsoft, Yahoo, Google 
Facebook, PalTalk, AOL, Skype, YouTube 
Apple. 



Collection of communications on fiber cables 
and infrastructure as data flows past. 

(FAIRVIEW, STORMBREW, BLARNEY, 

QakstA r) 



PRISM 
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(TS//SI//NF) FAA702 Operations 

Why Use Both: PRISM vs. Upstream 








PRISM 


Upstream 


DNI Selectors 


9 U.S. based service 
providers 


Worldwide 
s/ sources 


DNR Selectors 


Coming soon 


Worldwide 

sources 


Access to Stored 
Communications 
(Search) 


✓ 


0 


Real-Time Collection 
(Surveillance) 


Ly 


r? 


“Abouts” Collection 


0 


! 1 


Voice Collection 


Voice over IP 


rv 


Direct Relationship with 
Comms Providers 


^^Only through FBI 


✓ 
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(TS//SI//NF) 



PRISM Collection Details 



Current Providers 



Microsoft (Hotmail, etc.) 

Google 

Yahoo! 

Facebook 
PalTalk 
YouTube 
Skype 
AOL 
Apple 






What Will You Receive in Collection 
(Surveillance and Stored Comms)? 
It varies by provider. In general: 




E-mail 

Chat - video, voice 

Videos 

Photos 

Stored data 

VoIP 

File transfers 
Video Conferencing 

Notifications of target activity - logins, etc. 
Online Social Networking details 

Special Requests 



Complete list and details on PRISM web page: 
Go PRISMFAA 
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Apple 

(added 

Oct 

~2012L 



AOL 

3 / 31/11 



Skype 

2 / 6/11 



YouTube 

9 / 24/10 



PalTalk 

12 / 7/09 



Google 

1 / 14/09 



6 / 3/09 



Yahoo 

3 / 12/08 



Microsoft 

9 / 11/07 



2007 2008 2009 2010 2011 2012 2013 



PRISM Program Cost: 
$20M per year 
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(ts//si//nf) Dates When PRISM Collection 
Began For Each Provider 
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(TS//SI//NF) FAA702 Reporting Highlight 
PRISM and STORMBREW Combine 
To 






RISM 



SAME-DAY NTOC/FBI COLLABORATION 

PREVENTS 150GB EXFIL EVENT FROM CLEARED DEFENSE CONTRACTOR (CDC) 




U.S. CDC 



The victim performed co 

EXFILTRATION on the S 




4TOC TIPS FBI TO 
IMMINENT THREAT 

2 NTOC tips the 
FBI to the 
activity 



;tions on the infected n< 

NTOC DISCOVER!! 




The FBI contacts the 
CDC and works with 
them to clean the 



thus PfiSfe^feNTING 

Irsary intent 

toWeWeI //Sl//UKUJN//NUhUKlN 
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(TS//S1//NF) 



PRISM Tasking Process 






Target Analyst inputs selectors into 
Unified Targeting Tool (UTT) 

Surveillance^^^T^^^ T* Pending Stored Comms 



S2 FAA Adjudicators in Each Product Line 

Targeting Review/Validation 




Special FISA Oversight and Processing 
(SV4) 

Stored Comms Review /Validation 


Surveillance ► Pending Stored 


Comms 


Targeting and Mission Management (S343) 

Final Targeting Review and Release 



Unified Targeting Tool (UTT) 
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RISM 



TRAFFICTHIEF 



FBI DITU 



(TS//SI//NF) PRISM Collection Dataflow 



PRINTAURA, 

S3532 



rocessing 



SCISSORS, 

T132 



Protocol 
Exploitation, 
S3 132 

T 



SCISSORS, 

T132 



DNI Content, Videos 



FAA 
[Partitions 



Metadata 



PINWALE 



MARINA 

& 

MAINWAY 

FALLOUT 



CONVEYANCE 



NUCLEON 
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PRISM Provider 
PI: Microsoft 
P2: Yahoo 
P3: Google 
P4: Facebook 
P5: PalTalk 
P6: YouTube 
P7: Skype 
P8: AOL 
PA: Apple 
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PRISM Case Notations 






RISM 



P2ESQC1 20001 234 



T 



J 











Fixed trigraph, denotes 
PRISM source collection 


Year CASN established 
for selector 


Serial # 



Content Type 

A: Stored Comms (Search) 

B: IM (chat) 

C: RTN-EDC (real-time notification of an e-mail event such as a login 
or sent message) 

D: RTN-IM (real-time notification of a chat login or logout event) 

E: E-Mail 
F: VoIP 

G: Full (WebForum) 

H: OSN Messaging (photos, wallposts, activity, etc.) 

I: OSN Basic Subscriber Info 
J: Videos 

. (dot): Indicates multiple types 
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REPRISMFISA TIPS 
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REPRISMFISA COUNTERTERRORISM 




2013-Apr-05 13:10:282 



Click on the PRISM icon first 

( from t he initial wetoaggl 

PRISM ENTRIES 



* 

DOJ FISA 



Last Load on Apr 05. 2013 at 12:22 PM GMT 




Check the total record 



link 



QUICK LINKS 



• See Enure List (Current and Expired) 

• SeeNSAUst 

• See New Records 

• Ownership Count 



SEARCH 

The search form below can be used as a filter to see a partial Irst of 
records. 



Se«chFoi: 

Oano 0OR 



Eiptibondiys 
|« liomnoMi 



If Ihg.total co unt is much less than this, 

R£PRI5MF I^_i^h^ymK ^ ^uc^ E -MAIL 
the REPRISMFISA HELP* DESK AT 



Enter 



Aiip„tNmBjyuiiciyi 



Prism Current Entries 



Record* 1 S8 out of 117*75 



P*9* 1 of 2354 > » Record* per page: 



Ctedl Sou Ol « lei I chtfc on column header* to *ort. * = column m not portable . 
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